<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('modify.content'); $rowId = (int)($_POST['row_id'] ?? 0); $itemsJson = $_POST['items'] ?? ''; $items = json_decode($itemsJson, true); if (!$rowId || !is_array($items)) { exit(json_encode(['success' => false, 'error' => 'Invalid data'])); } foreach ($items as $it) { $id = (int)($it['id'] ?? 0); $order = (int)($it['order'] ?? 0); $width = max(1, min(3, (int)($it['width'] ?? 1))); if ($id > 0) { Database::execute( "UPDATE order_items SET item_order = :o, slot_width = :w WHERE id = :id AND row_id = :r", [':o' => $order, ':w' => $width, ':id' => $id, ':r' => $rowId] ); } } exit(json_encode(['success' => true])); 